Checking processes

If you change your mind about running a program, e.g. because it crashes or because it takes too long to execute, you can check the status and even stop a process. On most systems, this will only work for jobs which you started with your own userid, so for jobs that are owned by yourself. We will discuss some of the most popular tools for monitoring processes.

The ps command

There are many options and a couple of environment variables for ps, for which we refer to the manpages. When entered with no options, ps gives a snapshot of the processes currently running from a terminal.

7839 pts/6    00:00:00 bash
8709 pts/6    00:00:08 mozilla-bin
8712 pts/6    00:00:00 mozilla-bin
8713 pts/6    00:00:00 mozilla-bin
8714 pts/6    00:00:00 mozilla-bin
8715 pts/6    00:00:00 mozilla-bin
8717 pts/6    00:00:00 xload
8774 pts/6    00:00:00 ps

At the very least, when entered, ps will display itself. In this basic form, ps lists ProcessID (PID), the terminal identification from which a command has been startedi (TTY), the computer time that a process has used (hh:mm:ss) and the name of the command.

If you have more than one terminal (virtual or real) connected to the system, you may want to check on processes that you started from elsewhere, or check on processes of other users. This is done with the ps -ef command, which gives a detailed listing of every process on the system. Since most systems easily run 100 processes at the time, you will want to grep some lines out of the full output, e.g. in the following example we display the processes involved in a typical graphical session (X session):

tille:~>ps -ef | grep tille
tille     6803  6790  0 Jun04 ?        00:00:00 /usr/bin/gnome-session --purge-d
tille     6854  6803  0 Jun04 ?        00:00:00 /usr/bin/ssh-agent -- /usr/bin/g
tille     6859     1  0 Jun04 ?        00:00:05 gnome-smproxy --sm-config-prefix
tille     6871     1  0 Jun04 ?        00:00:25 /usr/bin/sawfish --sm-client-id 
tille     6873     1  0 Jun04 ?        00:00:27 panel --sm-config-prefix /panel.
tille     6875     1  0 Jun04 ?        00:00:00 gnome-name-service
tille     6879     1  0 Jun04 ?        00:00:14 tasklist_applet --activate-goad-
tille     6881     1  0 Jun04 ?        00:00:12 deskguide_applet --activate-goad
tille     6885     1  0 Jun04 ?        00:02:15 gnome-terminal --use-factory --s
tille     6887  6885  0 Jun04 ?        00:00:00 gnome-pty-helper
tille     6902  6885  0 Jun04 pts/3    00:00:00 bash
tille     6958  6885  0 Jun04 pts/4    00:00:00 bash
tille     6968  6958  0 Jun04 pts/4    00:00:02 ssh sprawl
tille     7499     1  0 Jun05 ?        00:03:33 /usr/lib/netscape/netscape-commu
tille     7523  7499  0 Jun05 ?        00:00:00 (dns helper)
tille     7598  6885  0 Jun05 pts/2    00:00:00 bash
tille     7839  6885  0 Jun05 pts/6    00:00:00 bash
tille     8149  6902  0 Jun05 pts/3    00:00:00 less LDP-Author-Guide.xml
tille     8669  6902  0 09:54 pts/3    00:00:04 vim chap7.xml
tille     8717  7839  0 10:18 pts/6    00:00:00 xload
tille     8792  7839  0 10:34 pts/6    00:00:00 ps -ef
tille     8793  7839  0 10:34 pts/6    00:00:00 grep tille

The full option displays the UserID (UID) that started the process, ProcessID, the Parent ProcessID (PPID), %CPU (time used devided by the time the process is running, C), time of day or date the process started (STIME), originating terminal (TTY, processes that have not been started from a terminal are indicated with a question mark), and the name of the command.


There are two types of programs on a Unix system: directly executable programs or binaries stored in a file the system can read directly, and interpreted programs, such as shellscripts, that store sequences of commands that need to be read by an interpreter program such as your shell. So when you execute an interpreted program or command, you will start additional commands that will do the interpreting.

The top tool

The top command is an extension to ps. If it should not be installed on your system, ask your sysadmin to get it, it's freely available. The top will execute ps, with a couple of options depending on your system, every 5 seconds and display repetitive updates of the system state.

The top command displays the time of day, the number of users currently logged in, the amount and state of processes. Then it gives info about CPU, memory and swap resource usage. Below these general system state statistics it displays full information about the most active processes. On some older systems top may as well be a top process in its own right, because the information displayed is updated by default every 5 seconds, which can put a lot of pressure on a system. Because of this resource eating behaviour, it is not recommended to run top all the time from login to logout.

Figure 1. Top view

Quit the top with the q-key.

The uptime command

The uptime command displays how long a system has been running and some information about the current load:

9:30am  up 38 days, 22:29,  7 users,  load average: 0.00, 0.00, 0.00

The time is 9:30 in the morning, the system has been up for 38 days, 22 hours and 29 minutes, there are currently 7 users logged in and the average load has been 0 during the last minute, the last 5 minutes and the last 15 minutes. On some systems, this is the same as the header line displayed by the w command and it is in fact the first line displayed by the top

The xload command

The xload tool displays a little window presenting a frequently updated system state.

There are lots of graphical system monitoring tools, e.g. gtop, lavaps and other tools that come with your particular window manager.

The ptree or pstree command

This command gives an overview of the hierarchical structure of all running processes:

  |              `-rpciod
  |      |-sshd---bash
  |      `-sshd---bash---pstree